@ouro.bot/cli 0.1.0-alpha.230 → 0.1.0-alpha.233

package/changelog.json

@@ -1,6 +1,38 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.233",
+      "changes": [
+        "feat: first-class MCP tools \u2014 MCP tools now appear in the agent tool list directly (no shell indirection). Agent can call browser_navigate, browser_click etc. as native tools.",
+        "fix: daemon MCP pre-init poisoned singleton \u2014 removed eager getSharedMcpManager() at daemon startup that cached null before agent identity was set.",
+        "fix: removed dead mcpManager field from BuildSystemOptions \u2014 MCP manager now flows through runAgentOptions.",
+        "fix: MCP tool results filter to text-only content types.",
+        "includes: vault integration, travel advisory fix, credential access layer, HKDF-Expand crypto fix."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.232",
+      "changes": [
+        "feat: first-class MCP tools \u2014 MCP server tools now appear in the agent's active tool list (e.g. browser_navigate, duffel_search_flights) and are callable directly by the model, eliminating fragile shell indirection",
+        "feat: mcpToolsAsDefinitions() converts McpManager tools to ToolDefinition objects with {server}_{tool} naming",
+        "feat: first-class MCP trust gating \u2014 mcpServerName on GuardContext enables per-server trust rules (browser blocked for acquaintance, blocked in group chat)",
+        "refactor: removed mcpToolsSection() from system prompt \u2014 MCP tools no longer need prompt documentation",
+        "fix: execTool, isConfirmationRequired, summarizeArgs now check combined native+MCP registry"
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.231",
+      "changes": [
+        "fix: defense-in-depth group chat blocking for proactive BB delivery \u2014 sendProactiveBlueBubblesMessageToSession now rejects group chat keys (;+;) unless intent is explicit_cross_chat (bridge/delegation responses). All upper-layer paths (surface tool, send_message tool, inner-dialog delegation) now filter to DM sessions only for proactive outreach, and pass explicit_cross_chat intent for bridge/delegation returns where group responses are legitimate.",
+        "fix: travel advisory now resolves ISO codes that differ from FIPS (ES -> Spain, not El Salvador)",
+        "fix: MCP bridge sense now includes MCP tool descriptions in system prompt (browser tools visible)",
+        "fix: removed confirmationRequired from credential_store/credential_delete (trust gating sufficient)",
+        "feat: vault integration \u2014 Bitwarden/Vaultwarden account creation with PBKDF2/HKDF/AES-256-CBC crypto",
+        "feat: vault_setup tool for one-time vault provisioning (family trust gated)",
+        "feat: BitwardenCredentialStore wrapping bw CLI for agent-owned vault access"
+      ]
+    },
     {
       "version": "0.1.0-alpha.230",
       "changes": [
@@ -10,14 +42,14 @@
     {
       "version": "0.1.0-alpha.229",
       "changes": [
-        "fix: BB session key resolution prefers DM (;-;) over group chat (;+;) — alphabetical sort put group chats first, causing proactive messages to land in group chats instead of personal DMs",
+        "fix: BB session key resolution prefers DM (;-;) over group chat (;+;) \u2014 alphabetical sort put group chats first, causing proactive messages to land in group chats instead of personal DMs",
         "chore: remove temporary debug traces (send-message-debug.log, friends.get_called event)"
       ]
     },
     {
       "version": "0.1.0-alpha.227",
       "changes": [
-        "fix: direct filesystem name resolution in sendProactiveBlueBubblesMessageToSession — bypass store.get()/listAll() with raw fs reads on friends directory when store lookup fails"
+        "fix: direct filesystem name resolution in sendProactiveBlueBubblesMessageToSession \u2014 bypass store.get()/listAll() with raw fs reads on friends directory when store lookup fails"
       ]
     },
     {

package/dist/heart/core.js

@@ -481,7 +481,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
     }
     catch { /* unsupported */ }
     const toolPreferences = currentContext?.friend?.toolPreferences;
-    const baseTools = options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, channel_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities);
+    const baseTools = options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, channel_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities, options?.mcpManager);
     // Augment tool context with reasoning effort controls from provider
     const augmentedToolContext = options?.toolContext
         ? {

package/dist/heart/daemon/daemon.js

@@ -320,9 +320,8 @@ class OuroDaemon {
                 /* v8 ignore stop */
             });
         }
-        // Pre-initialize MCP connections so they're ready for the first command (non-blocking)
-        /* v8 ignore next -- catch callback: getSharedMcpManager logs errors internally @preserve */
-        (0, mcp_manager_1.getSharedMcpManager)().catch(() => { });
+        // MCP connections are lazily initialized per-agent during senseTurn
+        // (daemon manages multiple agents; agent identity must be set before loading MCP config)
         /* v8 ignore start -- orphan cleanup + pidfile: calls process management functions @preserve */
         killOrphanProcesses();
         /* v8 ignore stop */

package/dist/heart/identity.js

@@ -33,7 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.HARNESS_CANONICAL_REPO_URL = exports.DEFAULT_AGENT_SENSES = exports.DEFAULT_VAULT_SERVER_URL = exports.DEFAULT_AGENT_PHRASES = exports.DEFAULT_AGENT_CONTEXT = exports.PROVIDER_CREDENTIALS = void 0;
+exports.resolveVaultConfig = resolveVaultConfig;
 exports.buildDefaultAgentTemplate = buildDefaultAgentTemplate;
 exports.getAgentName = getAgentName;
 exports.getRepoRoot = getRepoRoot;
@@ -74,6 +75,17 @@ exports.DEFAULT_AGENT_PHRASES = {
     tool: ["running tool"],
     followup: ["processing"],
 };
+exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouro.bot";
+/**
+ * Resolve the vault config for an agent, applying defaults.
+ * If vault is not configured in agent.json, returns default values.
+ */
+function resolveVaultConfig(agentName, config) {
+    return {
+        email: config?.email ?? `${agentName}@ouro.bot`,
+        serverUrl: config?.serverUrl ?? exports.DEFAULT_VAULT_SERVER_URL,
+    };
+}
 exports.DEFAULT_AGENT_SENSES = {
     cli: { enabled: true },
     teams: { enabled: false },
@@ -403,6 +415,7 @@ function loadAgentConfig() {
         senses: normalizeSenses(parsed.senses, configFile),
         mcpServers: parsed.mcpServers,
         phrases: parsed.phrases,
+        vault: parsed.vault,
     };
     (0, runtime_1.emitNervesEvent)({
         event: "identity.resolve",

package/dist/mind/prompt.js

@@ -36,7 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetPsycheCache = resetPsycheCache;
 exports.buildSessionSummary = buildSessionSummary;
 exports.bodyMapSection = bodyMapSection;
-exports.mcpToolsSection = mcpToolsSection;
 exports.runtimeInfoSection = runtimeInfoSection;
 exports.toolRestrictionSection = toolRestrictionSection;
 exports.startOfTurnPacketSection = startOfTurnPacketSection;
@@ -219,23 +218,8 @@ my bones give me the \`ouro\` cli. always pass \`--agent ${agentName}\`:
 
 provider/model changes via \`ouro config model\` or \`ouro auth switch\` take effect on the next turn automatically — no restart needed.`;
 }
-function mcpToolsSection(mcpManager) {
-    if (!mcpManager)
-        return "";
-    const allTools = mcpManager.listAllTools();
-    if (allTools.length === 0)
-        return "";
-    const lines = [
-        `## mcp tools (use ouro mcp call <server> <tool> --args '{...}')`,
-    ];
-    for (const entry of allTools) {
-        lines.push(`### ${entry.server}`);
-        for (const tool of entry.tools) {
-            lines.push(`- ${tool.name}: ${tool.description}`);
-        }
-    }
-    return lines.join("\n");
-}
+// mcpToolsSection removed — MCP tools are now first-class citizens in the tool registry
+// and appear in the model's active tool list directly. No system prompt section needed.
 function readBundleMeta() {
     try {
         const metaPath = path.join((0, identity_1.getAgentRoot)(), "bundle-meta.json");
@@ -1045,7 +1029,6 @@ async function buildSystem(channel = "cli", options, context) {
         // Group 3: my tools & capabilities
         "# my tools & capabilities",
         toolsSection(channel, options, context),
-        mcpToolsSection(options?.mcpManager),
         reasoningEffortSection(options),
         skillsSection(),
         toolContractsSection(options),

package/dist/nerves/coverage/file-completeness.js

@@ -57,6 +57,7 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "repertoire/tools-continuity",
     "repertoire/tools-surface",
     "repertoire/tools-config",
+    "repertoire/tools-base",
     // CLI sub-modules: cli-exec.ts is the router with emitNervesEvent calls;
     // cli-parse and cli-render are pure functions with no side effects.
     "daemon/cli-parse",

package/dist/repertoire/bitwarden-store.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * Bitwarden CLI credential store — wraps `bw` CLI for the agent's own vault.
+ *
+ * Unlike AacCredentialStore (which accesses someone else's vault via approval),
+ * this store authenticates directly as the agent using its own master password.
+ * The agent owns the vault, so no human-in-the-loop is needed.
+ *
+ * Requires the `bw` CLI to be installed. Session tokens are cached in-memory.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BitwardenCredentialStore = void 0;
+const node_child_process_1 = require("node:child_process");
+const runtime_1 = require("../nerves/runtime");
+// ---------------------------------------------------------------------------
+// bw CLI wrapper
+// ---------------------------------------------------------------------------
+function execBw(args, sessionToken) {
+    const env = sessionToken
+        ? { ...process.env, BW_SESSION: sessionToken }
+        : process.env;
+    return new Promise((resolve, reject) => {
+        (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout) => {
+            if (err) {
+                reject(new Error(`bw CLI error: ${err.message}`));
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// BitwardenCredentialStore
+// ---------------------------------------------------------------------------
+class BitwardenCredentialStore {
+    serverUrl;
+    email;
+    masterPassword;
+    sessionToken = null;
+    constructor(serverUrl, email, masterPassword) {
+        this.serverUrl = serverUrl;
+        this.email = email;
+        this.masterPassword = masterPassword;
+    }
+    isReady() {
+        return true;
+    }
+    /**
+     * Ensure the bw CLI is authenticated and unlocked.
+     * Handles three states: logged out → login, locked → unlock, already unlocked → no-op.
+     */
+    async login() {
+        // Check current status
+        let status = {};
+        try {
+            const raw = await execBw(["status"]);
+            status = JSON.parse(raw);
+        }
+        catch {
+            // CLI not configured or broken — proceed with full setup
+        }
+        // Configure server URL if needed (only works when logged out)
+        if (status.status === "unauthenticated" || !status.serverUrl) {
+            try {
+                await execBw(["config", "server", this.serverUrl]);
+            }
+            catch {
+                // "Logout required" means already logged in — that's fine, skip config
+            }
+        }
+        if (status.status === "locked") {
+            // Already logged in, just needs unlock
+            const unlockOutput = await execBw(["unlock", this.masterPassword, "--raw"]);
+            this.sessionToken = unlockOutput.trim();
+        }
+        else if (status.status === "unauthenticated" || !status.status) {
+            // Not logged in — full login
+            const loginOutput = await execBw(["login", this.email, this.masterPassword, "--raw"]);
+            try {
+                const parsed = JSON.parse(loginOutput);
+                this.sessionToken = parsed.access_token ?? loginOutput.trim();
+            }
+            catch {
+                this.sessionToken = loginOutput.trim();
+            }
+        }
+        else {
+            // Status is "unlocked" — already good, just need the session token
+            const unlockOutput = await execBw(["unlock", this.masterPassword, "--raw"]);
+            this.sessionToken = unlockOutput.trim();
+        }
+    }
+    async ensureSession() {
+        if (!this.sessionToken) {
+            await this.login();
+        }
+        /* v8 ignore next -- defensive: login() always sets sessionToken on success @preserve */
+        return this.sessionToken ?? undefined;
+    }
+    async get(domain) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_get_start",
+            component: "repertoire",
+            message: `getting credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        const session = await this.ensureSession();
+        const item = await this.findItemByDomain(domain, session);
+        if (!item) {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_get_end",
+                component: "repertoire",
+                message: `no bw credential for ${domain}`,
+                meta: { domain, found: false, backend: "bitwarden" },
+            });
+            return null;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_get_end",
+            component: "repertoire",
+            message: `bw credential found for ${domain}`,
+            meta: { domain, found: true, backend: "bitwarden" },
+        });
+        return {
+            domain: item.name,
+            username: item.login?.username,
+            notes: item.notes ?? undefined,
+            createdAt: item.revisionDate ?? new Date().toISOString(),
+        };
+    }
+    async getRawSecret(domain, field) {
+        const session = await this.ensureSession();
+        const item = await this.findItemByDomain(domain, session);
+        if (!item) {
+            throw new Error(`no credential found for domain "${domain}"`);
+        }
+        // Map common field names to bw item structure
+        let value;
+        if (field === "password") {
+            value = item.login?.password;
+        }
+        else if (field === "username") {
+            value = item.login?.username;
+        }
+        else {
+            value = item[field];
+        }
+        if (value === undefined || value === null) {
+            throw new Error(`field "${field}" not found for domain "${domain}"`);
+        }
+        return String(value);
+    }
+    async store(domain, data) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_store_start",
+            component: "repertoire",
+            message: `storing credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        const session = await this.ensureSession();
+        // Create a new login item
+        const item = {
+            type: 1, // Login type
+            name: domain,
+            login: {
+                username: data.username ?? "",
+                password: data.password,
+                uris: [{ match: null, uri: `https://${domain}` }],
+            },
+            notes: data.notes ?? null,
+        };
+        const encoded = Buffer.from(JSON.stringify(item)).toString("base64");
+        await execBw(["create", "item", encoded], session);
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_store_end",
+            component: "repertoire",
+            message: `credential stored via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+    }
+    async list() {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_list_start",
+            component: "repertoire",
+            message: "listing bw credentials",
+            meta: { backend: "bitwarden" },
+        });
+        const session = await this.ensureSession();
+        try {
+            const stdout = await execBw(["list", "items"], session);
+            const items = JSON.parse(stdout);
+            const results = items.map((item) => ({
+                domain: item.name,
+                username: item.login?.username,
+                notes: item.notes ?? undefined,
+                createdAt: item.revisionDate ?? new Date().toISOString(),
+            }));
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_list_end",
+                component: "repertoire",
+                message: "bw credentials listed",
+                meta: { backend: "bitwarden", count: results.length },
+            });
+            return results;
+        }
+        catch {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_list_end",
+                component: "repertoire",
+                message: "bw credential list failed",
+                meta: { backend: "bitwarden", count: 0 },
+            });
+            return [];
+        }
+    }
+    async delete(domain) {
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_delete_start",
+            component: "repertoire",
+            message: `deleting credential via bw for ${domain}`,
+            meta: { domain, backend: "bitwarden" },
+        });
+        const session = await this.ensureSession();
+        const item = await this.findItemByDomain(domain, session);
+        if (!item) {
+            (0, runtime_1.emitNervesEvent)({
+                event: "repertoire.bw_credential_delete_end",
+                component: "repertoire",
+                message: `no bw credential to delete for ${domain}`,
+                meta: { domain, deleted: false, backend: "bitwarden" },
+            });
+            return false;
+        }
+        await execBw(["delete", "item", item.id], session);
+        (0, runtime_1.emitNervesEvent)({
+            event: "repertoire.bw_credential_delete_end",
+            component: "repertoire",
+            message: `credential deleted via bw for ${domain}`,
+            meta: { domain, deleted: true, backend: "bitwarden" },
+        });
+        return true;
+    }
+    // --- Private ---
+    async findItemByDomain(domain, session) {
+        try {
+            const stdout = await execBw(["list", "items", "--search", domain], session);
+            const items = JSON.parse(stdout);
+            // Find exact match by name
+            return items.find((item) => item.name === domain) ?? items[0] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.BitwardenCredentialStore = BitwardenCredentialStore;

package/dist/repertoire/credential-access.js

@@ -417,29 +417,60 @@ exports.AacCredentialStore = AacCredentialStore;
 let _store = null;
 /**
  * Get the credential store singleton.
- * Tries aac first (if binary exists and has sessions); falls back to BuiltInCredentialStore.
+ *
+ * Priority:
+ *   1. BitwardenCredentialStore — if vault config exists in agent.json + secrets.json
+ *   2. BuiltInCredentialStore — fallback for agents without a vault (local-only, encrypted files)
+ *
+ * Future auth providers (1Password, etc.) would be added here as additional backends.
  */
 function getCredentialStore() {
     if (_store)
         return _store;
-    // Default to BuiltInCredentialStore — aac detection is async and
-    // would need to be done at startup. For now, always use built-in.
-    // Callers can explicitly create AacCredentialStore if needed.
     let agentName;
+    let backend = "built-in";
     try {
         // Dynamic import to avoid circular dependency at module level
         const identity = require("../heart/identity");
         agentName = identity.getAgentName();
+        // Try to load vault config from agent.json + secrets.json
+        const config = identity.loadAgentConfig?.();
+        const vaultConfig = identity.resolveVaultConfig?.(agentName, config?.vault);
+        const secretsPath = identity.getAgentSecretsPath?.(agentName);
+        let vaultSecrets;
+        /* v8 ignore start -- requires real agent secrets.json + vault config + bw CLI @preserve */
+        if (secretsPath) {
+            try {
+                const fs = require("fs");
+                const secrets = JSON.parse(fs.readFileSync(secretsPath, "utf-8"));
+                vaultSecrets = secrets.vault;
+            }
+            catch {
+                // No secrets file or no vault section — fall through to built-in
+            }
+        }
+        const serverUrl = vaultConfig?.serverUrl;
+        const email = vaultConfig?.email;
+        const masterPassword = vaultSecrets?.masterPassword;
+        if (serverUrl && email && masterPassword) {
+            const { BitwardenCredentialStore } = require("./bitwarden-store");
+            _store = new BitwardenCredentialStore(serverUrl, email, masterPassword);
+            backend = "bitwarden";
+        }
+        /* v8 ignore stop */
     }
     catch {
         agentName = "default";
     }
-    _store = new BuiltInCredentialStore(agentName);
+    /* v8 ignore next -- false branch only reachable when BitwardenCredentialStore was created above @preserve */
+    if (!_store) {
+        _store = new BuiltInCredentialStore(agentName);
+    }
     (0, runtime_1.emitNervesEvent)({
         event: "repertoire.credential_store_init",
         component: "repertoire",
         message: "credential store initialized",
-        meta: { backend: "built-in", agentName },
+        meta: { backend, agentName: agentName },
     });
     return _store;
 }

package/dist/repertoire/guardrails.js

@@ -284,7 +284,7 @@ function checkWriteTrustGuardrails(toolName, args, context) {
 }
 // --- credential tool trust gating ---
 // Credential write tools: family only
-const CREDENTIAL_FAMILY_TOOLS = new Set(["credential_store", "credential_delete"]);
+const CREDENTIAL_FAMILY_TOOLS = new Set(["credential_store", "credential_delete", "vault_setup"]);
 // Credential read tools: friend+
 const CREDENTIAL_TRUSTED_TOOLS = new Set(["credential_get", "credential_list"]);
 // Travel tools: friend+ (weather_lookup accesses vault credentials indirectly;
@@ -303,12 +303,30 @@ function checkCredentialTrustGuardrails(toolName, context) {
     }
     return allow;
 }
+function checkFirstClassMcpTrust(context) {
+    if (!context.mcpServerName)
+        return allow;
+    const rules = MCP_SERVER_TRUST[context.mcpServerName];
+    if (!rules)
+        return allow;
+    if (!trustLevelSatisfied(rules.minTrust, context.trustLevel ?? "friend")) {
+        return deny(REASONS.needsTrust);
+    }
+    if (rules.blockGroupChat && context.isGroupChat) {
+        return deny("browser tools are only available in 1:1 conversations, not group chats.");
+    }
+    return allow;
+}
 function checkTrustLevelGuardrails(toolName, args, context) {
     // Credential tools have their own trust rules that apply at all levels
     const credentialResult = checkCredentialTrustGuardrails(toolName, context);
     if (!credentialResult.allowed)
         return credentialResult;
-    // MCP server-specific trust (e.g. browser blocked in group chats) — applies at all trust levels
+    // First-class MCP tool trust (e.g. browser_navigate) — applies at all trust levels
+    const firstClassMcpResult = checkFirstClassMcpTrust(context);
+    if (!firstClassMcpResult.allowed)
+        return firstClassMcpResult;
+    // MCP server-specific trust via shell (e.g. ouro mcp call browser) — applies at all trust levels
     if (toolName === "shell") {
         const mcpResult = checkMcpServerTrust(args.command || "", context);
         if (!mcpResult.allowed)

package/dist/repertoire/mcp-tools.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * First-class MCP tool integration — converts MCP server tools into ToolDefinitions
+ * so the model can call them directly without shell indirection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpToolsAsDefinitions = mcpToolsAsDefinitions;
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Convert all tools from an McpManager into ToolDefinition objects.
+ * Each tool gets named `{server}_{tool}` (e.g., `browser_navigate`).
+ * The handler calls `mcpManager.callTool()` and returns concatenated text content.
+ */
+function mcpToolsAsDefinitions(mcpManager) {
+    if (!mcpManager)
+        return [];
+    return mcpManager.listAllTools().flatMap((entry) => entry.tools.map((tool) => ({
+        tool: {
+            type: "function",
+            function: {
+                name: `${entry.server}_${tool.name}`,
+                description: tool.description || `MCP tool: ${tool.name} (server: ${entry.server})`,
+                parameters: tool.inputSchema ?? { type: "object", properties: {} },
+            },
+        },
+        handler: async (args) => {
+            (0, runtime_1.emitNervesEvent)({
+                event: "mcp.tool_start",
+                component: "repertoire",
+                message: `calling MCP tool ${entry.server}/${tool.name}`,
+                meta: { server: entry.server, tool: tool.name },
+            });
+            try {
+                const result = await mcpManager.callTool(entry.server, tool.name, args);
+                const text = result.content
+                    .filter((c) => c.type === "text" && c.text)
+                    .map((c) => c.text)
+                    .join("");
+                (0, runtime_1.emitNervesEvent)({
+                    event: "mcp.tool_end",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} completed`,
+                    meta: { server: entry.server, tool: tool.name },
+                });
+                return text;
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                (0, runtime_1.emitNervesEvent)({
+                    level: "error",
+                    event: "mcp.tool_error",
+                    component: "repertoire",
+                    message: `MCP tool ${entry.server}/${tool.name} failed: ${reason}`,
+                    meta: { server: entry.server, tool: tool.name, reason },
+                });
+                return `[mcp error] ${entry.server}/${tool.name}: ${reason}`;
+            }
+        },
+        mcpServer: entry.server,
+    })));
+}

package/dist/repertoire/tools-base.js

@@ -10,6 +10,7 @@ const tools_continuity_1 = require("./tools-continuity");
 const tools_config_1 = require("./tools-config");
 const tools_1 = require("./coding/tools");
 const tools_credential_1 = require("./tools-credential");
+const tools_vault_1 = require("./tools-vault");
 const tools_travel_1 = require("./tools-travel");
 // Re-export flow tools for consumers that import them from tools-base
 var tools_flow_1 = require("./tools-flow");
@@ -35,6 +36,7 @@ exports.baseToolDefinitions = [
     ...tools_config_1.configToolDefinitions,
     ...tools_1.codingToolDefinitions,
     ...tools_credential_1.credentialToolDefinitions,
+    ...tools_vault_1.vaultToolDefinitions,
     ...tools_travel_1.travelToolDefinitions,
 ];
 // Convenience array of just the tool schemas (no handler/integration metadata).

package/dist/repertoire/tools-credential.js

@@ -95,7 +95,6 @@ exports.credentialToolDefinitions = [
                 return `Credential store error: ${err instanceof Error ? err.message : String(err)}`;
             }
         },
-        confirmationRequired: true,
         summaryKeys: ["domain"],
     },
     {
@@ -178,7 +177,6 @@ exports.credentialToolDefinitions = [
                 return `Credential delete error: ${err instanceof Error ? err.message : String(err)}`;
             }
         },
-        confirmationRequired: true,
         summaryKeys: ["domain"],
     },
 ];

package/dist/repertoire/tools-session.js

@@ -592,11 +592,10 @@ exports.sessionToolDefinitions = [
                     const bbDir = path.join(agentRoot, "state", "sessions", friendId, "bluebubbles");
                     if (fs.existsSync(bbDir)) {
                         const files = fs.readdirSync(bbDir).filter((f) => f.endsWith(".json"));
-                        // Prefer individual chats (;-;) over group chats (;+;) for proactive DMs
+                        // Only use DM sessions (;-;) for proactive delivery — never group chats (;+;)
                         const dmFile = files.find((f) => f.includes(";-;"));
-                        const chosen = dmFile ?? files[0];
-                        if (chosen) {
-                            resolvedKey = chosen.replace(/\.json$/, "");
+                        if (dmFile) {
+                            resolvedKey = dmFile.replace(/\.json$/, "");
                         }
                     }
                 }

package/dist/repertoire/tools-surface.js

@@ -118,6 +118,7 @@ exports.surfaceToolDefinition = {
                                     friendId: bridgeTarget.friendId,
                                     sessionKey: bridgeTarget.key,
                                     text: content,
+                                    intent: "explicit_cross_chat",
                                 });
                                 if (proactiveResult.delivered) {
                                     // Inject surfaced content into the target session so it knows what was delivered
@@ -145,8 +146,8 @@ exports.surfaceToolDefinition = {
                 // Priority 2: Try proactive delivery first, then queue to freshest session
                 const allFriendSessions = (0, session_activity_1.listSessionActivity)({ sessionsDir, friendsDir, agentName, activeThresholdMs: Number.MAX_SAFE_INTEGER })
                     .filter((s) => s.friendId === friendId && s.channel !== "inner");
-                // 2a: Attempt proactive BB delivery on any BB session (prefer freshest)
-                const bbSession = allFriendSessions.find((s) => s.channel === "bluebubbles");
+                // 2a: Attempt proactive BB delivery on a DM session (;-; = individual, never ;+; = group)
+                const bbSession = allFriendSessions.find((s) => s.channel === "bluebubbles" && s.key.includes(";-;"));
                 if (bbSession) {
                     const { sendProactiveBlueBubblesMessageToSession } = await Promise.resolve().then(() => __importStar(require("../senses/bluebubbles")));
                     const proactiveResult = await sendProactiveBlueBubblesMessageToSession({